SB20261029177 - Improper locking in Linux kernel iucv

Description

This security bulletin contains information about 1 vulnerability.

1) Improper locking (CVE-ID: CVE-2026-99133)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt kernel operation by triggering a sleeping allocation in an atomic context.

The vulnerability exists due to improper locking in iucv_sock_recvmsg() when a window update calls iucv_send_ctrl() while message_q.lock is held with spin_lock_bh(). A local user can invoke recvmsg() to reach a GFP_KERNEL allocation inside the atomic section, potentially causing scheduling errors or a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8f2efa742f4cfe7dd756154f8bc07350dbe3ec92
• https://git.kernel.org/stable/c/fa5acd038ea657ad5033713d6916214cbd349151
• https://git.kernel.org/stable/c/fe7393a627db2d093e8c0cae69d619b30fefae5f